CD Virus


 Virus Name:  CD 
 Aliases:     Thursday The 12th 
 V Status:    Rare 
 Discovery:   August, 1991 
 Symptoms:    .COM & .EXE growth; decrease in total system & available free 
              memory; disk write protect errors 
 Origin:      Germany 
 Eff Length:  2,161 - 2,175 Bytes 
 Type Code:   PRhA - Parasitic Resident .COM & .EXE Infector 
 Detection Method:  ViruScan, F-Prot, Sweep, AVTK, ChAV, 
                    IBMAV, NAV, NAVDX, VAlert, PCScan, 
                    NShld, Sweep/N, LProt, Innoc, NProt, AVTK/N, NAV/N, 
                    IBMAV/N 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The CD virus was submitted in August, 1991, from Germany.  CD is 
       a memory resident infector of .COM and .EXE files, and does not 
       infect COMMAND.COM.  On Thursdays that are the 12th day of the 
       month, it will display a message. 
 
       The first time a program infected with CD is executed, CD will 
       install itself memory resident at the top of system memory, but 
       below the 640K DOS boundary.  Total system and available free 
       memory, as measured by the DOS CHKDSK program, will have 
       decreased by 2,448 bytes.  Interrupt 21 will be hooked by the 
       CD virus in memory. 
 
       Once memory resident, CD will infect .COM and .EXE programs when 
       they are executed if their original file length was less than 
       approximately 63K bytes.  Infected programs increase in size by 
       2,161 to 2,175 bytes with the virus being located at the end of 
       the infected file. 
 
       Attempts to execute programs from write protected diskettes with 
       CD memory resident will result in a write protect error as the 
       virus does not intercept this error condition. 
 
       On Thursdays that are the twelveth day of the month, it will 
       display the following message after every fourth program is 
       executed: 
 
             浜様様様様様様 VirCheck V1.2 (C) 1991 様様様様様融 
               Be aware of those worms out there, violating   
               your machine on Friday 13th = it's tomorrow!   
                                                              
                   Special thanks to Ross M. Greenberg,       
                   Patricia M. Hoffmann and John McAfee       
                                                              
             藩様様様様 Press any key to continue... 様様様様夕 
 
       The virus does not do anything besides display the message in 
       the highlighted box in the center of the screen.  If the system 
       user strikes any key, the program they were attempting to execute 
       will be then execute. 
 
       Known variant(s) of CD are: 
       Thursday The 12th: Similar to CD, this variant's major change 
                          is that it will also infect programs on open as 
                          well as execution.  This variant was isolated 
                          in Iceland, and was received in September, 1991. 

Show viruses from discovered during that infect .

Main Page